PT-2021-14266
CVE-2021-20812
·
Published
2021-08-26
·
Updated
2021-09-01
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
Movable Type Advanced versions 7.0.0 through 7 r.4903
Movable Type Premium Advanced versions 1.0.0 through 1.44
Description:
A cross-site scripting issue in the Setting screen of Server Sync of Movable Type allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
Recommendations:
For Movable Type Advanced versions 7.0.0 through 7 r.4903, update to a version later than 7 r.4903 to resolve the issue.
For Movable Type Premium Advanced versions 1.0.0 through 1.44, update to a version later than 1.44 to resolve the issue.
As a temporary workaround, consider restricting access to the Setting screen of Server Sync to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾